Estimate savings
Two modes in one tool:
forecast — given either a proposed_config (explicit per-pattern action rows from configure_engine) or a target_percent, runs the same greedy solver as configure_engine and projects low/expected/high savings per pattern at the destination's $/GB rate.
verify — given a baseline_window (pre-merge) and post_window (post-merge), queries all_events_summaryBytes_total segmented by the engine's isDropped label and attributes the delta to four buckets: cap_fired, drift, new_patterns, leakage.
Example
You
estimate savings if I drop the top 5 patterns in checkout-svc on Splunk
Log10x
Forecast (splunk): $2,140/mo expected savings (at Splunk list price) on 5 patterns (coverage 73%).
Range: $1,680–$2,600/mo · Annual projection: $25,680
More to ask
- "forecast 30% reduction on payment-svc, destination datadog"
- "verify savings after last week's policy merge"
- "estimate savings if I compact top 20 patterns"
Prerequisites
Reporter deployed (for TSDB metrics). destination required. For verify mode, engine >= 1.0.8 (for the isDropped label).
Schema and samples
Input schema
Agent-facing JSON Schema (the canonical shape the MCP server publishes via tools/list):
{
"type": "object",
"properties": {
"mode": {
"type": "string",
"enum": [
"forecast",
"verify"
],
"default": "forecast",
"description": "forecast: project savings of a proposed per-pattern policy (or a target_percent). verify: measure realized savings from a deployed policy by comparing baseline vs post-merge windows."
},
"proposed_config": {
"type": "array",
"items": {
"type": "object",
"properties": {
"pattern_hash": {
"type": "string",
"description": "Stable pattern identity (tenx_hash)."
},
"action": {
"type": "string",
"enum": [
"pass",
"sample",
"compact",
"tier_down",
"offload",
"drop"
],
"description": "Action the receiver would take for this pattern."
},
"cap_bytes_per_window": {
"type": "number",
"minimum": 0,
"description": "Per-5min-window cap in bytes. Informational; the forecast computes savings from `action` alone."
},
"sample_n": {
"type": "integer",
"exclusiveMinimum": 0,
"description": "For action='sample', N where we keep 1 in N. Default 10."
}
},
"required": [
"pattern_hash",
"action"
],
"additionalProperties": false
},
"description": "forecast mode: explicit per-pattern (action, optional cap) rows. Either this OR target_percent is required."
},
"target_percent": {
"type": "number",
"minimum": 1,
"maximum": 95,
"description": "forecast mode: % volume reduction goal. Tool runs the same greedy solver as configure_engine on observed 30d bytes."
},
"default_action": {
"type": "string",
"enum": [
"pass",
"sample",
"compact",
"tier_down",
"offload",
"drop"
],
"default": "compact",
"description": "forecast mode: action assigned to top patterns by the greedy solver when target_percent is used. This is a hard constraint — every per_pattern row receives this action (subject to destination compatibility: compact is silently replaced by the destination canonical action when compact_mode=no-op). Default: compact."
},
"pattern_limit": {
"type": "integer",
"exclusiveMinimum": 0,
"default": 50,
"description": "forecast mode: maximum number of per_pattern rows returned. Default 50 when service is omitted; ignored (unlimited) when service is set. Totals and coverage_pct are always computed over the full solver result before slicing."
},
"destination": {
"type": "string",
"enum": [
"splunk",
"datadog",
"elasticsearch",
"clickhouse",
"cloudwatch",
"azure-monitor",
"gcp-logging",
"sumo"
],
"description": "Destination SIEM. Required for both modes (used to look up ingest $/GB + compact ratio band)."
},
"es_pruned": {
"type": "boolean",
"description": "Elasticsearch only: are compactable fields excluded from _source? Default false — the unpruned ratio band is used."
},
"service": {
"type": "string",
"description": "Scope the target_percent greedy solver and coverage_pct to a single service. When present, only patterns from that service are candidates; coverage_of_env_pct and dollar totals reflect that service only. pattern_limit is ignored (all service patterns are returned). If omitted, runs across all services."
},
"retention_months": {
"type": "number",
"exclusiveMinimum": 0,
"default": 1,
"description": "Retention window for storage cost. Default 1 month."
},
"baseline_window": {
"type": "string",
"pattern": "^\d+[dh]$",
"description": "verify mode: PromQL range expression for the pre-merge window, e.g. \"7d\", \"168h\"."
},
"post_window": {
"type": "string",
"pattern": "^\d+[dh]$",
"description": "verify mode: PromQL range expression for the post-merge window, e.g. \"7d\"."
},
"commitment_id": {
"type": "string",
"description": "verify mode: when present, the verify output is shaped as a commitment delta (used by log10x_commitment_report)."
},
"contract_type": {
"type": "string",
"enum": [
"committed",
"on_demand"
],
"description": "verify mode: shapes the dollar projection (committed vs on-demand renewal math)."
},
"effective_ingest_per_gb": {
"type": "number",
"exclusiveMinimum": 0,
"description": "forecast and verify mode: override the destination list-price rate with the customer's contracted $/GB. When supplied, dollar projections use this rate and surface rate_source='customer_supplied'."
},
"enforcement_mode": {
"type": "string",
"enum": [
"engine",
"manual_report"
],
"description": "forecast mode: when manual_report, reframes the headline as a potential-savings estimate under external enforcement rather than engine enforcement. Headline reads 'If you enforce externally: X savings potential. Enforcement choice is yours.' instead of the standard forecast headline."
},
"environment": {
"type": "string",
"description": "Environment nickname; routes to the right metrics backend."
}
},
"additionalProperties": false
}
Source: src/tools/estimate-savings.ts.
Output schema
The data block inside the StructuredOutput envelope:
For forecast mode:
interface ForecastData {
mode: 'forecast';
destination: string;
service?: string;
observation_window: string;
per_pattern: Array<{
pattern_hash: string;
action: string;
bytes_in_monthly: number;
bytes_saved_monthly: number;
dollars_saved_low: number;
dollars_saved_expected: number;
dollars_saved_high: number;
}>;
totals: {
bytes_saved_monthly: number;
dollars_low_monthly: number;
dollars_expected_monthly: number;
dollars_high_monthly: number;
annual_projection_expected: number;
};
coverage_pct: number;
caveats: string[];
}
For verify mode: delivered_pct, attribution (cap_fired_bytes / drift_bytes / new_patterns_bytes / leakage_bytes), causal_confidence, rate_source.
Envelope-level fields: summary.headline, actions[], schema_epoch.